Pentesting, digital forensics, and hacking distributions

July 27, 2013 10:21 pm

If you are interested in penetration testing (pentesting), digital forensics, and in playing with software applications that hackers use on a daily basis, there are several Linux distributions that make those applications readily available.

These are niche or specialty distributions that have been packaged with all the Free Software applications that the best in the business use, and that anybody with a computer can download and install.

There are just a handful of these distributions and all have had at least one article about them published on this website. In alphabetical order, they are:

1. BackBox: BackBox is designed for pentesting, incident response, computer forensics, and intelligence gathering. It is based on Ubuntu Desktop, and uses the old version of the graphical Ubuntu installer that does not have support for LVM, the Linux Logical Volume Manager. It is developed by Raffaele Forte and a small but dedicated team. It uses the Xfce desktop environment.

This screen shot shows the category of applications that ship with BackBox. You may access articles and tutorials about this distribution published on this website from here. Installation ISO images for 32- and 64-bit platforms are available for download here.

2. CAINE:CAINE (Computer Aided INvestigative Environment) is a Linux distribution specially crafted for performing digital forensics. Like DEFT (see below), it also comes with a complete Office suite and other applications used for regular desktop computing tasks.

The latest edition, CAINE 4.0, code-named Pulsar, was released on March 18 2013. ISO installation images are available for download here.

3. DEFT: DEFT is based on Lubuntu, which itself is based on Ubuntu Desktop. Like CAINE, it is primarily designed for computer forensics, using WINE to run Windows’ freeware forensics applications. It is designed for use by those in the military, private security professional, IT auditors and anybody else interested in computer forensics. It uses the LXDE desktop environment and also ships with a complete suite of Office applications and other standard applications used for desktop computing.

DEFT 8, the latest edition, was released just a few days ago. It is available for download from here. The lone article that has been published about it on this website is accessible here.

4. KALI: This distribution is published by the founders of Offensive Security, an outfit that provides security training and pentesting services. In a previous incarnation, KALI Linux was known as BackTrack Linux, and was based on Ubuntu Desktop. However, the current form is based on Debian Testing, and uses the same graphical installation program as its parent distribution.

The screen shot below is from a test installation of version 1.0.4, the latest release. ISO installation images are available for download here. You may read articles and tutorials about KALI published on this website from here.

5. Matrius: Like KALI, Matrius comes loaded with the best applications for pentesting and hacking. And like KALI, it is also based on Debian. However, it runs the GNOME 2 desktop, and not the tweaked GNOME Shell that is the default graphical interface on Kali.

Published articles about this distribution on this website are available here. You may download the latest version from here. This screen shot is from an installation of the latest edition. It is code-named Ec-Centric.

I’ll use Kali and Matrius for general hacking and pentesting. Not that they can’t be used for forensics, but most of the tools are for hacking and penetration testing. Of Matrius and Kali, the latter takes the top spot.

DEFT, BackBox and CAINE are specifically designed for forensics. So, I’ll go with them if I have an investigative task to perform.

Not listed in this article is wifislax, a distribution specifically designed for wireless hacking. I’ll publish a “review” of the latest edition in a day or two.

Have been trying to get BackBox 3.05 to load up, and it just won’t. There is no install option in the boot menu, just a live option. I’ve tried a few different edits to the boot cmline, but nothing has worked yet. I’m disappointed and thinking of trying the other distros… I especially need the ability to inventory systems, as we have a case of “server creep”.